refactor!: rename the packages and brand to the jevkit family

Two of the three packages are not DSH-specific, and the @dsh-jev scope said
otherwise. A Claude Desktop user looking for a Jev MCP server would have read
@dsh-jev/mcp as "not for me", as would anyone writing a plain script against
@dsh-jev/core. Only the DSH adapter is DSH-specific, so only it now carries dsh.

  @dsh-jev/core   -> jevkit
  @dsh-jev/plugin -> jevkit-dsh
  @dsh-jev/mcp    -> jevkit-mcp

Both adapters depend on the root name, so the dependency direction is readable
from the names alone.

The rename reached every runtime identifier a user or host can see, not just the
manifests: the Cordis plugin name, the MCP server name and bin command, the
Config Standard Schema vendor field, the startup egress prefix, and the config
and gate error messages. A stale plugin name or egress prefix is the kind of
thing that only shows up when someone reads a log line, so each was replaced by
an assertion that fails on an unexpected number of hits rather than a blind
substitution.

The CI tarball glob is fixed too: it still matched dsh-jev-*.tgz after the
rename, so the clean-room install step would have failed on the next run.

Verified after the rename: 360 tests pass, all three packages typecheck, the
schema check passes, both MCP smoke tests pass (including the live one against
real System One models), the tarballs pack as jevkit/jevkit-dsh/jevkit-mcp with
LICENSE and NOTICE, and a clean-room install of the packed artifacts loads 64
core exports with the MCP default still offline. The harness profile's links were
rebuilt and the local plugin loads.

Author: dsh-jev

.github/workflows/ci.yml

@@ -46,15 +46,15 @@ jobs:
         # handshake, discovery, calls, and the error path.
         env:
           TYPESAFE_API_KEY: ''
-        run: pnpm --filter @dsh-jev/mcp run smoke
+        run: pnpm --filter jevkit-mcp run smoke
 
       - name: Cross-check our payloads against the vendor's own schemas
         # The unit tests stub the SDKs, so they prove our side of the contract
         # but not that a vendor would accept it. This imports the real zod
         # schemas and parses what this project actually builds. Offline and
         # credential-free by design. It is what caught `score.criteria` being
         # sent as a keyed map when both vendors require an ordered array.
-        run: pnpm --filter @dsh-jev/core run check:schemas
+        run: pnpm --filter jevkit run check:schemas
 
   package:
     runs-on: ubuntu-latest
@@ -107,12 +107,12 @@ jobs:
         run: |
           mkdir -p /tmp/cleanroom && cd /tmp/cleanroom
           echo '{"name":"cleanroom","private":true,"version":"1.0.0"}' > package.json
-          pnpm --dir "$GITHUB_WORKSPACE" --filter @dsh-jev/core pack --pack-destination .
-          pnpm --dir "$GITHUB_WORKSPACE" --filter @dsh-jev/mcp pack --pack-destination .
-          npm install --no-audit --no-fund ./dsh-jev-core-*.tgz ./dsh-jev-mcp-*.tgz
+          pnpm --dir "$GITHUB_WORKSPACE" --filter jevkit pack --pack-destination .
+          pnpm --dir "$GITHUB_WORKSPACE" --filter jevkit-mcp pack --pack-destination .
+          npm install --no-audit --no-fund ./jevkit-*.tgz ./jevkit-mcp-*.tgz
           node -e "
-            const core = await import('@dsh-jev/core');
-            const mcp = await import('@dsh-jev/mcp');
+            const core = await import('jevkit');
+            const mcp = await import('jevkit-mcp');
             if (typeof core.JevService !== 'function') throw new Error('core did not load');
             if (typeof mcp.createServer !== 'function') throw new Error('mcp did not load');
             const runtime = await mcp.buildRuntime(() => undefined);

CHANGELOG.md

@@ -8,6 +8,33 @@ Notable changes, newest first. The format follows
 
 Initial implementation. Pre-1.0, so the API may change between minor versions.
 
+### Changed
+
+- **Renamed the packages and the brand from the `@dsh-jev` scope to the `jevkit`
+  family**, before any publish, because two of the three packages are not
+  DSH-specific and the scope said otherwise:
+
+  | Was | Now | Role |
+  |---|---|---|
+  | `@dsh-jev/core` | `jevkit` | framework-agnostic core |
+  | `@dsh-jev/plugin` | `jevkit-dsh` | the DeepSeek Harness plugin |
+  | `@dsh-jev/mcp` | `jevkit-mcp` | the MCP server |
+
+  A Claude Desktop user looking for a Jev MCP server would have read
+  `@dsh-jev/mcp` as "not for me", and the same went for anyone writing a plain
+  script against `@dsh-jev/core`. Only the DSH adapter is DSH-specific, and now
+  only its name says so. Both adapters depend on the root name, so the
+  dependency direction is readable from the names alone.
+
+  The rename also reached the runtime identifiers a user or host can see: the
+  Cordis plugin name (`jevkit`), the MCP server name and `bin` command
+  (`jevkit-mcp`), the `Config` Standard Schema `vendor` field, the startup egress
+  prefix (`[jevkit]`), and the config/gate error messages.
+
+  Unscoped family names have to be claimed individually — npm registers
+  ownership of a scope, not a name prefix — so `jevkit`, `jevkit-dsh` and
+  `jevkit-mcp` were each confirmed free before the rename.
+
 ### Added
 
 - **An OpenRouter route to the same models.** OpenRouter hosts the System One
@@ -23,7 +50,7 @@ Initial implementation. Pre-1.0, so the API may change between minor versions.
   `typesafe/` prefix is refused before the call, because any other model answers
   with prose this plugin cannot interpret as a decision.
 
-- **`@dsh-jev/core`** — framework-agnostic decision layer.
+- **`jevkit`** — framework-agnostic decision layer.
   - The three System One primitives (`noul`, `choice`, `score`) with validation.
   - `MockProvider`, deterministic and offline, which labels every answer as
     synthetic in three places so it cannot be mistaken for a real judgment.
@@ -38,14 +65,14 @@ Initial implementation. Pre-1.0, so the API may change between minor versions.
     trusted.
   - Two gates: a safety gate on `tools/pre-execute` and a context gate on
     `tools/post-execute`, both framework-agnostic and both off by default.
-- **`@dsh-jev/plugin`** — the DeepSeek Harness plugin.
+- **`jevkit-dsh`** — the DeepSeek Harness plugin.
   - `ctx.jev`, a first-class service other plugins can call with no model turn
     in between.
   - Three model-visible tools: `jev_ask`, `jev_rank`, `jev_check`.
   - `Config` implemented as a Standard Schema, which Cordis requires before a
     plugin starts.
   - Startup egress report on one line per feature.
-- **`@dsh-jev/mcp`** — the same three tools over MCP, with a stdio binary that
+- **`jevkit-mcp`** — the same three tools over MCP, with a stdio binary that
   writes its egress report to stderr so the protocol channel stays clean.
 
 ### Fixed

CONTRIBUTING.md

@@ -9,9 +9,9 @@ Three packages over one decision layer:
 
 | Package | What it is |
 |---|---|
-| `@dsh-jev/core` | The decisions. No framework dependency — it imports nothing from DeepSeek Harness or Cordis. |
-| `@dsh-jev/plugin` | The DeepSeek Harness plugin: three tools, one service, two opt-in gates. |
-| `@dsh-jev/mcp` | The same three tools over MCP, for hosts that are not DSH. |
+| `jevkit` | The decisions. No framework dependency — it imports nothing from DeepSeek Harness or Cordis. |
+| `jevkit-dsh` | The DeepSeek Harness plugin: three tools, one service, two opt-in gates. |
+| `jevkit-mcp` | The same three tools over MCP, for hosts that are not DSH. |
 
 Jev answers typed questions and returns calibrated probabilities. It does not
 generate text. Any change that treats it as a chat model is out of scope.
@@ -71,7 +71,7 @@ Please do not open a public issue. See [SECURITY.md](./SECURITY.md).
 ## Scope
 
 Welcome: better judgments, better prompts for the primitives, additional
-framework adapters over `@dsh-jev/core`, documentation fixes, and bug reports
+framework adapters over `jevkit`, documentation fixes, and bug reports
 with a reproduction.
 
 Out of scope: anything that turns this into a general-purpose LLM client;

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 dsh-jev contributors
+Copyright (c) 2026 jevkit contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

NOTICE

@@ -1,7 +1,7 @@
 # NOTICE
 
-dsh-jev — TypeSafe Jev for DeepSeek Harness
-Copyright (c) 2026 dsh-jev contributors
+jevkit — TypeSafe Jev for DeepSeek Harness
+Copyright (c) 2026 jevkit contributors
 Licensed under the MIT License. See [LICENSE](./LICENSE).
 
 ## Not affiliated with TypeSafe AI
@@ -22,11 +22,11 @@ remain under their own licences:
 
 | Package | Role | Declared as |
 |---|---|---|
-| `@typesafe-ai/sdk` | Official TypeSafe client, used by the `live` provider | optional dependency of `@dsh-jev/core` |
-| `@openrouter/sdk` | Official OpenRouter client, used by the `openrouter` provider | optional dependency of `@dsh-jev/core` and `@dsh-jev/mcp` |
-| `@modelcontextprotocol/sdk` | MCP server and stdio transport | dependency of `@dsh-jev/mcp` |
-| `zod` | Wire-schema validation for the MCP surface | dependency of `@dsh-jev/mcp` |
-| `@deepseek-ai/dsh-tools` | DeepSeek Harness tool registry | peer dependency of `@dsh-jev/plugin`, supplied by the harness at runtime |
+| `@typesafe-ai/sdk` | Official TypeSafe client, used by the `live` provider | optional dependency of `jevkit` |
+| `@openrouter/sdk` | Official OpenRouter client, used by the `openrouter` provider | optional dependency of `jevkit` and `jevkit-mcp` |
+| `@modelcontextprotocol/sdk` | MCP server and stdio transport | dependency of `jevkit-mcp` |
+| `zod` | Wire-schema validation for the MCP surface | dependency of `jevkit-mcp` |
+| `@deepseek-ai/dsh-tools` | DeepSeek Harness tool registry | peer dependency of `jevkit-dsh`, supplied by the harness at runtime |
 
 The optional dependencies are loaded lazily. An install that omits them still
 runs, on the offline mock provider.

PUBLISHING.md

@@ -7,13 +7,16 @@ Run every step from the repository root.
 
 ## 0. Package names — decided
 
-The three packages publish under the `@dsh-jev` scope:
+The three packages publish as a **family of unscoped names**, rooted at `jevkit`:
 
-| Directory | Package |
-|---|---|
-| `packages/core` | `@dsh-jev/core` |
-| `packages/dsh` | `@dsh-jev/plugin` |
-| `packages/mcp` | `@dsh-jev/mcp` |
+| Directory | Package | Role |
+|---|---|---|
+| `packages/core` | `jevkit` | The framework-agnostic decision core |
+| `packages/dsh` | `jevkit-dsh` | The DeepSeek Harness / Cordis plugin |
+| `packages/mcp` | `jevkit-mcp` | The MCP server |
+
+Both adapters depend on the root name, so a reader can infer the dependency
+direction from the names alone. Nothing but the DSH adapter carries `dsh`.
 
 ### Why not the bare name `dsh-jev`
 
@@ -23,24 +26,38 @@ free up. Two packages with the same name and different behaviour is a support
 burden for both authors, and the collision is worse than usual here because
 theirs targets the same framework and the same model.
 
-Verify the scope is still yours before publishing; an npm scope belongs to
-whoever publishes into it first:
+### Why not a `@dsh-jev` scope
 
-```sh
-npm view @dsh-jev/core version   # 404 means the scope is still unclaimed
-```
+That was the earlier plan and it was wrong, for a reason worth recording: two of
+the three packages are **not** DSH-specific. A Claude Desktop user looking for a
+Jev MCP server would find `@dsh-jev/mcp` and reasonably conclude it was not for
+them, and someone writing a plain script would read the same into
+`@dsh-jev/core`. Scoping everything under the framework's name mis-sold two
+thirds of the project. Only the DSH adapter should say `dsh`, and now only it
+does.
+
+### Why `jevkit`
 
-### Why `plugin` rather than `dsh`
+`jev-kit`, `jev-mcp`, `jev-tools`, `jev-core` and `jev-plugin` are taken or
+risk reading as official TypeSafe packages. `jevkit` is free, avoids a `jev-`
+prefix that implies first-party status, and `kit` says "tools for" rather than
+"attachment to a framework".
 
-`@dsh-jev/dsh` was the first choice and it reads badly: the same three letters
-appear twice with different meanings, so the scope and the package cannot be told
-apart at a glance. `@dsh-jev/plugin` names the thing rather than repeating the
-framework it targets, and it matches what the other two already do — scope for
-the project, leaf for the artifact.
+### Unscoped names must be claimed individually
+
+npm registers ownership of a **scope** (`@scope/`), not a name prefix. There is
+no such thing as owning `jevkit-*`: `jevkit`, `jevkit-dsh` and `jevkit-mcp` are
+three independent names and each has to be free at publish time. Verify before
+publishing:
+
+```sh
+for n in jevkit jevkit-dsh jevkit-mcp; do npm view "$n" version 2>&1 | head -1; done
+# 404 for each means all three are still claimable
+```
 
-If the scope is ever lost, the fallback is your own npm scope
-(`@<username>/dsh-jev` for the plugin, and matching leaves for core and mcp),
-which is what most of the DSH plugin ecosystem does.
+If a name is lost, the fallback is an npm scope you own
+(`@<username>/jevkit` and matching leaves), which is what most of the DSH plugin
+ecosystem does.
 
 ## 1. Pre-flight
 
@@ -53,10 +70,10 @@ Expected: 360 tests pass (266 core, 65 dsh, 29 mcp), with no credential set.
 
 ```sh
 # Parse what this project builds against the vendors' real schemas. Offline.
-pnpm --filter @dsh-jev/core run check:schemas
+pnpm --filter jevkit run check:schemas
 
 # Drive the MCP server over a real stdio transport, on the mock. Offline.
-pnpm --filter @dsh-jev/mcp run smoke
+pnpm --filter jevkit-mcp run smoke
 ```
 
 Both are credential-free by design and run in CI. The schema check is the one
@@ -75,8 +92,8 @@ changes that. Enable it under **Allowed providers** at
 
 ```sh
 export OPENROUTER_API_KEY=...                       # never commit this
-pnpm --filter @dsh-jev/core run probe:live          # provider level
-pnpm --filter @dsh-jev/mcp run smoke:live           # whole MCP surface
+pnpm --filter jevkit run probe:live          # provider level
+pnpm --filter jevkit-mcp run smoke:live           # whole MCP surface
 ```
 
 A passing run prints the real model (`typesafe/jev-1.13-<date>`), token usage and
@@ -138,9 +155,9 @@ Change the URL in each file, then `pnpm install` so the lockfile records it.
 ## 4. Inspect the tarballs before publishing
 
 ```sh
-pnpm --filter @dsh-jev/core pack --dry-run
-pnpm --filter @dsh-jev/plugin pack --dry-run
-pnpm --filter @dsh-jev/mcp pack --dry-run
+pnpm --filter jevkit pack --dry-run
+pnpm --filter jevkit-dsh pack --dry-run
+pnpm --filter jevkit-mcp pack --dry-run
 ```
 
 Check for each: `lib/` is present, `README.md` and `LICENSE` are included, and
@@ -150,12 +167,12 @@ nothing.
 
 ## 5. Publish
 
-Order matters: the two adapters depend on `@dsh-jev/core`.
+Order matters: the two adapters depend on `jevkit`.
 
 ```sh
-pnpm --filter @dsh-jev/core publish --access public
-pnpm --filter @dsh-jev/plugin publish --access public
-pnpm --filter @dsh-jev/mcp publish --access public
+pnpm --filter jevkit publish --access public
+pnpm --filter jevkit-dsh publish --access public
+pnpm --filter jevkit-mcp publish --access public
 ```
 
 Prefer publishing from CI with provenance over a laptop:
@@ -177,21 +194,21 @@ Do not trust the publish output; install what you actually shipped.
 
 ```sh
 mkdir /tmp/verify && cd /tmp/verify && npm init -y
-npm install @dsh-jev/core @dsh-jev/plugin @dsh-jev/mcp
-node -e "const c = require('@dsh-jev/core'); console.log(Object.keys(c).length, 'core exports')"
+npm install jevkit jevkit-dsh jevkit-mcp
+node -e "const c = require('jevkit'); console.log(Object.keys(c).length, 'core exports')"
 ```
 
 Then, for the DSH plugin, install it into a **throwaway profile** and confirm the
 row reaches `active` and the egress report appears:
 
 ```sh
-dsh plugin --profile verify-jev add @dsh-jev/plugin
+dsh plugin --profile verify-jev add jevkit-dsh
 ```
 
 For the MCP server:
 
 ```sh
-npx -y @dsh-jev/mcp    # should print the egress report to stderr and wait
+npx -y jevkit-mcp    # should print the egress report to stderr and wait
 ```
 
 ## Known-before-you-publish